The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for their involvement in North Korean government-orchestrated information technology (IT) worker schemes that defraud U.S. companies and generate revenue for the Democratic People’s Republic of Korea’s (DPRK) weapons of mass destruction programs, including nearly $800 million in 2024.
Secretary of the Treasury Scott Bessent stated that the North Korean regime “targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.” He emphasized that Treasury remains committed to tracking and blocking these activities to protect U.S. businesses and hold responsible parties accountable.
The sanctioned networks exploit fraudulent documents, stolen identities, and fabricated personas to secure employment with legitimate companies in the U.S. and allied countries. Wages earned by these overseas IT workers are largely appropriated by the DPRK government, funding WMD and ballistic missile programs in violation of U.S. and United Nations sanctions. In some cases, DPRK-affiliated workers have also covertly introduced malware into company networks to extract proprietary information.
The action targets facilitators based in the DPRK, Vietnam, Laos, and Spain. Amnokgang Technology Development Company, a DPRK IT firm managing delegations of overseas IT workers and procuring military and commercial technology, was designated under Executive Order (E.O.) 13810 for operating in North Korea IT sector.
In Vietnam, Nguyen Quang Viet, CEO of Quangvietdnbg International Services Company Limited, facilitated currency conversion for North Koreans, including converting approximately $2.5 million in earnings from Amnokgang IT workers into cryptocurrency between mid-2023 and mid-2025. Both Nguyen and Quangvietdnbg were designated for materially assisting or supporting Amnokgang.
Additional sanctions were imposed on Do Phi Khanh and Hoang Van Nguyen, associates of U.S.-sanctioned DPRK nuclear procurement facilitator Kim Se Un, for opening bank accounts, enabling cryptocurrency transactions, and facilitating foreign currency operations in support of the DPRK regime. Do and Hoang also participated in a counterfeit goods deal exceeding $200,000 on Kim’s behalf.
DPRK national Yun Song Guk, who coordinates freelance IT operations from Boten, Laos, was designated under E.O. 13810, along with associates Hoang Minh Quang and York Louis Celestino Herrera, for materially assisting, sponsoring, or providing support for Yun’s IT revenue-generating activities. Together, these networks coordinated financial transactions totaling tens of thousands of dollars.
As a result of OFAC designations, all property and interests of the sanctioned individuals and entities in the United States or controlled by U.S. persons are blocked and must be reported to OFAC. Entities owned 50 percent or more by blocked persons are also subject to blocking. U.S. persons are generally prohibited from engaging in transactions involving any blocked property without a license, and violations may trigger civil or criminal penalties. Non-U.S. persons may also be subject to secondary sanctions if they knowingly facilitate transactions for designated individuals or entities. OFAC reiterated that financial institutions and other parties risk exposure if they transact with sanctioned individuals and organizations, including providing funds, goods, or services to or from blocked persons. The Treasury continues to collaborate with international partners to counter DPRK IT worker schemes and prevent the illicit flow of funds to the regime.